Danger Js
Monthly
OS command injection in danger-js up to version 13.0.7 allows low-privileged local attackers to execute arbitrary shell commands by supplying a maliciously crafted file path to the `danger.git.diffForFile` function. The vulnerable code in `localGetFileAtSHA.ts` constructs a git command via unsafe template string interpolation and passes it to Node.js `exec()`, which invokes a shell - meaning any shell metacharacters embedded in a filename (e.g., `x";touch /tmp/pwn;#`) break out of the quoted argument and run as OS commands. Vendor-released patch 13.0.8 is available; no public exploit has been identified at time of analysis.
OS command injection in danger-js up to version 13.0.7 allows low-privileged local attackers to execute arbitrary shell commands by supplying a maliciously crafted file path to the `danger.git.diffForFile` function. The vulnerable code in `localGetFileAtSHA.ts` constructs a git command via unsafe template string interpolation and passes it to Node.js `exec()`, which invokes a shell - meaning any shell metacharacters embedded in a filename (e.g., `x";touch /tmp/pwn;#`) break out of the quoted argument and run as OS commands. Vendor-released patch 13.0.8 is available; no public exploit has been identified at time of analysis.